[lkml]   [2005]   [Feb]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [PATCH] Filesystem linking protections
    Hash: SHA1

    Chris Wright wrote:
    > * Lorenzo Hernández García-Hierro ( wrote:
    >>This patch adds two checks to do_follow_link() and sys_link(), for
    >>prevent users to follow (untrusted) symlinks owned by other users in
    >>world-writable +t directories (i.e. /tmp), unless the owner of the
    >>symlink is the owner of the directory, users will also not be able to
    >>hardlink to files they do not own.
    >>The direct advantage of this pretty simple patch is that /tmp races will
    >>be prevented.
    > The disadvantage is that it can break things and places policy in the
    > kernel.

    It can break things, yes. For example, programs which have and use two
    separate FS UIDs at the same time, or which attempt to make hardlinks to
    files they don't own without CAP_FOWNER or root (should this just be
    CAP_FOWNER? Is root now irrelavent?).

    Hang on, when do any programs have 2 FS UIDs at the same time. . . .

    I've yet to see this break anything on Ubuntu or Gentoo; Brad Spengler
    claims this breaks nothing on Debian. On the other hand, this could
    potentially squash the second most prevalent security bug.

    > thanks,
    > -chris

    - --
    All content of all messages exchanged herein are left in the
    Public Domain, unless otherwise explicitly stated.

    Version: GnuPG v1.2.5 (GNU/Linux)
    Comment: Using GnuPG with Thunderbird -

    -----END PGP SIGNATURE-----
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 14:10    [W:0.022 / U:7.264 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site